device_policy(4)

NAME | DESCRIPTION | ATTRIBUTES | EXAMPLES | FILES | SEE ALSO

NAME

device_policy- device policy file

DESCRIPTION

The security policy for device files can differ from that for regular files and is configured through the device_policy database file. Rebooting the system in multiuser mode is required to effect the file's contents. Each entry in the file consists of one or more lines and represents the device policy configuration for one or more device files. A backslash (\) at the end of a line continues the next line as part of the current entry. A pound sign (#) as the first character of a line indicates a comment line, which is ignored. Each entry is of the form:

name:minor_name policy_type=value policy_type=value ... 

name is the name of a device driver.

minor_name is the actual name of a minor node, or a string of shell metacharacters that represent several minor nodes. See sh(1).

If two or more entries match a device, devpolicy(1M) uses the first matching entry. For example, for the following device_policy entries, the policy for /dev/ptyp0 will differ from the policy for other pty devices.

---

# # device_policy file # ptc: typ0 data_mac_policy=DR_MAC_EQ,DW_MAC_EQ # ptc:* data_mac_policy=DR_MAC_ANY,DW_MAC_ANY

---

policy_type=value specifies a policy for the device nodes. There are four policy types: data_mac_policy, attr_mac_policy, open_priv, and str_type. The policy types and their allowed values are described below.

data_mac_policy type

This policy type specifies what a process's sensitivity label must be to have access to the device. The specified policy is enforced by the open(2) and access(2) system calls. The value for this type is a comma-separated pair of values: a read-MAC value and a write-MAC value:

The read-MAC values are:

DR_MAC_ANY

Process may have any SL.

DR_MAC_EQ

Process SL must be equal to device SL.

DR_MAC_NEQ

Process SL must not equal device SL.

DR_MAC_NEVER

Device is not read accessible.

DR_MAC_SDOM

Process SL must dominate device SL.

DR_MAC_ODOM

Process SL must be dominated by device SL.

The write-MAC values are:

DW_MAC_ANY

Process may have any SL.

DW_MAC_EQ

Process SL must equal device SL.

DW_MAC_NEQ

Process SL must not equal device SL.

DW_MAC_NEVER

Device is not write accessible.

DW_MAC_SDOM

Process SL must dominate device SL.

DW_MAC_ODOM

Process SL must be dominated by device SL.

The optional read-MAC-modifier or write-MAC-modifier value is:

MOD_AUTO_ALLOC

Automatically allocate the device on behalf of the opening process.

MOD_GETDEVLABEL

Get label directly from device. This is used only for console-related pseudo-devices, such as /dev/console or /dev/syslog.

The default policy is

---

data_mac_policy=DR_MAC_EQ,DW_MAC_EQ

---

attr_mac_policy type

This policy type specifies how to handle access to the device's attributes by the operations acl(2), chmod(2), chown(2), and stat(2). The value for this type is a comma-separated set of values: a read-MAC value, a write-MAC value, and an optional read-MAC modifier:

The read-MAC values are:

DR_MAC_ANY

Process may have any SL.

DR_MAC_EQ

Process SL must equal device SL.

DR_MAC_NEQ

Process SL must not equal device SL.

DR_MAC_NEVER

Device is not read accessible.

DR_MAC_SDOM

Process SL must dominate device SL.

DR_MAC_ODOM

Process SL must be dominated by device SL.

The write-MAC values are:

DW_MAC_ANY

Process may have any SL.

DW_MAC_EQ

Process SL must equal device SL.

DW_MAC_NEQ

Process SL must not equal device SL.

DW_MAC_NEVER

Device is not write accessible.

DW_MAC_SDOM

Process SL must dominate device SL.

DW_MAC_ODOM

Process SL must be dominated by device SL.

The optional read-MAC-modifier value is:

MOD_FABRICATE

Return fabricated device attributes to the reading process. Fabrication is designed for a process that walks down an array of BSD-style pty's until it encounters an accessible pty (indicated by getting device attributes) or the end of the array.

The default policy is:

---

attr_mac_policy=DR_MAC_SDOM,DW_MAC_EQ

---

open_priv type

This policy type specifies a privilege required to open the device. The specified privilege is required in addition to the data MAC policy. Privilege names can be in upper or lower case; or an integer ordinal can be used. For example,

---

open_priv=sys_devices

---

The default policy is:

---

open_priv=none

---

str_type type

The streams type, meaningful only for streams devices, specifies how the kernel streams head should control streams messages. The value can be one of these keywords:

DSTR_LOOP

Loop type stream. Unlabeled streams control messages are allowed. Unlabeled data messages are not allowed.

DSTR_NET

Network type Stream. Unlabeled Stream messages are not allowed.

DSTR_DEV

Device type Stream. Unlabeled Stream messages are allowed.

An example is:

---

str_type=DSTR_NET

---

The default policy is:

---

str_type=STR_DEV

---

ATTRIBUTES

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWtsu

EXAMPLES

---

Example 1 A complete policy -- Sample




mm:kmem	\
data_mac_policy=DR_MAC_EQ,DW_MAC_EQ		\
attr_mac_policy=DR_MAC_SDOM,DW_MAC_EQ		
mm:null	\
data_mac_policy=DR_MAC_ANY,DW_MAC_ANY		\
attr_mac_policy=DR_MAC_SDOM,DW_MAC_EQ		

---

FILES

/etc/security/tsol/device_policy

Device policy file.

SEE ALSO

Trusted Solaris 8 4/01 Reference Manual

devpolicy(1M)

SunOS 5.8 Reference Manual

sh(1), attributes(5)

SunOS 5.8  Last Revised 5 Oct 2000

NAME | DESCRIPTION | ATTRIBUTES | EXAMPLES | FILES | SEE ALSO